How to Shift from Managing Vulnerabilities